SUPPORT / SAMPLES & SAS NOTES
Problem Note 68825: Incremental indexing fails with a "...mapper_parsing_exception..." error in SAS® Visual Investigator
 |  |  |  |  |
A feature of alert management is that you can add your own field definitions as alert enrichment data. Using that feature enables you to display your own data details within an alert that is generated by SAS Visual Investigator. However, when running incremental indexing, the indexing job fails when all of the following conditions are met:
- The enrichment field for an alert has a datetime value.
- In that value, the seconds component has a fraction of a second greater than 0.5.
- In that fraction, there are more than two decimal places.
An example of this type of value would be 59.5062.
The unintended result is that the value is rounded up to 60, which is not considered a valid value (60 seconds would be the next minute). In the svi-indexer log, you then see an error message that is similar to the following:
2021-12-26 11:23:29.007 ERROR 13964 --- [titionExecutor2] c.s.f.d.s.data.index.IndexService : service [99e27b56346] Elasticsearch indexing error [operation=index, index=sand__alerts__143567825468, type=alerts, id=aad42547-be22-2756-b3712-c092b6cfdf4e, status=400, response='{"type":"mapper_parsing_exception","reason":"failed to parse field [enrichment_json_doc.my_alert_date] of type [date] in document with id 'aad42547-be22-2756-b3712-c092b6cfdf4e'","caused_by":{"type":"illegal_field_value_exception","reason":"Cannot parse \"2021-12-21T02:09:60Z\": Value 60 for secondOfMinute must be in the range [0,59]"}}', errorType='mapper_parsing_exception']
Click the Hot Fix tab in this note for a link to instructions about accessing and applying the software update.
Operating System and Release Information
| Product Family | Product | System | Product Release | SAS Release | ||
| Reported | Fixed* | Reported | Fixed* | |||
| SAS System | SAS Visual Investigator | Linux for x64 | 10.7 | Viya | ||